1metadata:
  2  id: audit-log-001
  3  type: AuditLog
  4  gemara-version: "1.1.0"
  5  version: "1.0.0"
  6  description: "Q1 2026 Gemara Audit"
  7  author:
  8    id: lead-auditor
  9    name: "Jane Auditor"
 10    type: Human
 11  mapping-references:
 12    - id: security-policy
 13      title: "Information Security Policy"
 14      version: "2.1.0"
 15    - id: OSPS
 16      title: "Open Source Project Security Baseline"
 17      version: "2025.1"
 18      url: "https://baseline.openssf.org"
 19    - id: eval-log
 20      title: "PVTR Evaluation Log"
 21      version: "2025-08-22"
 22      url: "https://artifacts.example.com/eval-logs/pvtr-baseline-scan.yaml"
 23    - id: enforcement-log
 24      title: "Example Enforcement Log"
 25      version: "2025-08-22"
 26      url: "https://artifacts.example.com/enforcement-logs/enforcement-log-001.yaml"
 27    - id: github-api
 28      title: "GitHub Dependency Graph API"
 29      version: "2026"
 30      url: "https://docs.github.com/en/rest/dependency-graph"
 31
 32target:
 33  id: gemara-repo
 34  name: "gemaraproj/gemara"
 35  type: Software
 36  uri: "https://github.com/gemaraproj/gemara"
 37  environment: production
 38  owner:
 39    name: "Gemara Maintainers"
 40    affiliation: "OpenSSF"
 41
 42owner:
 43  responsible:
 44    - name: "Jane Auditor"
 45      affiliation: "External Audit Firm"
 46  accountable:
 47    - name: "Project Lead"
 48      affiliation: "OpenSSF"
 49
 50summary: "Access control and quality controls are strong. Documentation controls have gaps requiring remediation."
 51
 52criteria:
 53  - reference-id: security-policy
 54    remarks: "Organizational policy establishing the audit's scope."
 55  - reference-id: OSPS
 56    remarks: "Baseline whose controls each result is scored against."
 57
 58results:
 59  - id: AR-AC-01
 60    title: "MFA enforcement verified"
 61    type: Strength
 62    description: "Multi-factor authentication is enforced at the organization level for all contributors."
 63    criteria-reference:
 64      reference-id: OSPS
 65      entries:
 66        - reference-id: OSPS-AC-01
 67
 68  - id: AR-DO-01
 69    title: "User documentation missing"
 70    type: Gap
 71    description: "No user guide is published or referenced in the Security Insights data."
 72    criteria-reference:
 73      reference-id: OSPS
 74      entries:
 75        - reference-id: OSPS-DO-01
 76    evidence:
 77      - id: EV-DO-01
 78        type: EvaluationLog
 79        description: "PVTR evaluation results for documentation controls"
 80        collected-at: "2025-08-22T16:02:00Z"
 81        source:
 82          reference-id: eval-log
 83          entry-id: "assessment-do-01"
 84          coordinate: "$.results[0].checks[2]"
 85          digest: "sha256:c4d5e6f7a8b9012cdef34567890abcdef1234567890abcdef1234567890abc123"
 86    recommendations:
 87      - id: REC-01
 88        text: "Add user guide references to the Security Insights file and publish basic user documentation."
 89        required: true
 90
 91  - id: AR-DO-02
 92    title: "Vulnerability reporting channel not formalized"
 93    type: Finding
 94    description: "Private vulnerability reporting was not enabled prior to enforcement remediation."
 95    criteria-reference:
 96      reference-id: OSPS
 97      entries:
 98        - reference-id: OSPS-DO-02
 99    evidence:
100      - id: EV-DO-02
101        type: EnforcementLog
102        description: "Enforcement actions taken for documentation failures"
103        collected-at: "2025-08-22T16:05:00Z"
104        source:
105          reference-id: enforcement-log
106    recommendations:
107      - id: REC-02
108        text: "Formalize the private vulnerability reporting process and document it in SECURITY.md."
109
110  - id: AR-QA-01
111    title: "Dependency manifests present"
112    type: Observation
113    description: "Repository includes dependency manifests and the dependency graph is accessible via GitHub API."
114    criteria-reference:
115      reference-id: OSPS
116      entries:
117        - reference-id: OSPS-QA-02
118    evidence:
119      - id: EV-QA-01
120        type: api-response
121        description: "Dependency manifests from the GitHub dependency graph SBOM endpoint"
122        collected-at: "2026-02-10T15:05:00Z"
123        source:
124          reference-id: github-api
125          coordinate: "/repos/gemaraproj/gemara/dependency-graph/sbom"
126          digest: "sha256:a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890"